Let me start with one admonition: stop using the drive. The more that
you use it, the less likely that you'll be able to recover.

Now, let's look at options...

•

Restore your most recent backup

The easiest solution is to simply grab the most recent backup that you took of
that drive and restore its contents or restore the backed up copies of what you
deleted.

In fact, it's exactly because of these types of scenarios that we take regular
backups in the first place.

Most people won't do what I'm suggesting.

Once restored, you've only lost whatever has changed in the time since that
backup was taken. If you're following a typically recommended pattern of some
form of nightly backup, that means that you've lost at most a day's worth of work.

It's by far the easiest, most reliable, and quickest way to recover from this
kind of problem.

You don't have a backup, you say?

Then the chances of a full recovery just got a lot smaller and the steps to
try a recovery just got a lot more complex.

Seriously, stop using the drive

If this is your system drive, or "C:" drive, then I strongly recommend that you
actually physically remove it and place it into an external USB enclosure.

You can then take it to another computer for the steps that follow.
Alternatively, you can install a new drive in your computer, reinstall Windows
onto that drive, and install any applications that you care to so that you can once again
have a working machine.

The goal here is to stop using that original drive. Every time Windows
writes to the drive, even when trying to boot, it's overwriting data that you might
want to recover. The only way to make sure that it doesn't happen is to not try to
boot from it at all or use it in any way. The safest way to do that is to make
it the second or external drive.

Try recovery tools

With the drive attached as a second or external drive, grab the free data
recovery tool
Recuva and turn it loose on the drive.

Recuva, and other tools like it, scan the drive media looking for deleted,
but possibly recoverable files, and allow you to specify which should be
restored.

This could be a painstaking and time-consuming process. The problem is that
file recovery tools don't know the difference between files that you just recently
deleted by accident and files that you deleted before that on purpose. They'll
identify all of the files which could be recovered and you'll need to see which of
those that you actually want to get back.

I recommend that you not recover in place. By that, I mean
rather than simply undeleting the files on the drive, copy the files to be
recovered to a different drive. This should avoid writing to the original drive
at all. The goal here is to minimize any changes to that drive until
all of the files that you want back have been recovered.

Practicality

Most people won't do what I'm suggesting.

Most won't have backups. Most will simply reboot from the drive, if they
can, and run recovery tools like Recuva to recover what they can. If they can't
even boot, most will actually reinstall Windows on that drive, overwriting most
of the data that they'd want to recover, and then try running recovery tools
after.

And most folks will quite possibly lose much of the data that they'd accidentally deleted permanently.

(You can guess where I'm going with this...)

Don't be like most people.

To begin with, start by backing up. You can see how easy it is to restore from
a backup compared to all of the steps required to - maybe - recover the deleted
files directly.

And if you do find yourself in a situation where important files have been
deleted and you have no backup to recover from, slow down and take the time to
do it right. That'll significantly improve your chances of recovering what was
lost.

1 For the curious, it was a
Linux server that I was setting up and I accidentally typed "rm -fr *" at the root
of the drive. For the non-Linux users, that's the
remove command, with the
force and recurse options, with "*" meaning
everything. Fortunately, it was early in the process and I just started
over.

Leo A. Notenboom has been playing with computers since he
was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed.
After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers
to common computer and technical questions. More about Leo.

"Blizzard"...there's a logo I haven't seen since the days of Starcraft and Diablo2 #I refused to play WOW when it came out as I'm certain it would have been too addicting for me and based on the fanbase I'm probably right#.

What's your poison Leo? WOW? Starcraft2? D3 beta tester perhaps?

WoW. When I have time.

23-Sep-2011

Gabe
September 20, 2011 8:53 AM

Unlike my other post, I'll stay a little more on topic here...I've not done an accidental delete of "everything" but I do have a friend who, in the early days, discovered the command "deltree" and somehow fat-fingered the "c:\" directory. He shortly afterward discovered how to reinstall Windows because he didn't do backups either.

Charles Reeves
September 20, 2011 9:00 AM

I accidentally deleted all my family pictures on my computer which numbered about 5000. I tried several expensive data recovery systems and all failed. Then I found Get Data Back & Deleted File Recovery and was able to recovery all of my pictures. That was one of the happiest days of my life. I now back up all of my files on 3 hard disk drives.

Glenn P.
September 20, 2011 9:39 AM

Hmmm...

As a C128 user, I regularly use a Unix CSH-shell account at our ISP, so "rm -fr *" isn't exactly unfamiliar, though I have never had occasion to use that particular combination of switches, myself. <<Shudder.>>

But I am curious: What, in freak's name, (besides Satan himself), could ever have possessed you to enter that particular command from your root directory?! Yikes!

I can assure you it wasn't intentional Simply a classing case of wanting to empty a directory thinking I was in that directory when I wasn't.

23-Sep-2011

Mark J
September 20, 2011 10:13 AM

One alternative to removing the disk or installing Windows to another drive, would be to boot Windows from a live PE CD or DVD or from Live Linux disc such as Ubuntu. Ubuntu is probably the easiest option as it freely downloadable and a PE disk needs to be created. Here's a tutorial to do itfrom Ubuntu.
http://www.howtogeek.com/howto/13706/recover-deleted-files-on-an-ntfs-hard-drive-from-a-ubuntu-live-cd/

Maggie
September 20, 2011 10:53 AM

Way, way back in the old DOS days, I managed type del *.* from the c:\ prompt. I was so used to answering "Y" when using the del command to delete such relatively useless things as backup doc files, that I was on autopilot and answered "Y". It was a mistake I made only once.

Glenn Meyer
September 20, 2011 11:02 AM

Always happy to hear that somebody else has done the "rm -rf *" command from the root directory. And to answer a previous comment, it happens because you're logged in as root, and for some reason you lose track of what directory you're in. Every long-term Linux/UNIX user I know of has done this once. I try to stay away from the people who have done it twice. ;) And just so Leo doesn't delete this message because it meanders too far off-topic, I have a followup: Are there any Linux live recovery CDs you'd recommend for recovering a Windows drive? My wife insists on using Windows XP, and I have to deal with trashed hard drives occasionally.

Mary Minshall
September 20, 2011 11:38 AM

I looked into the various means of backing up data on my hard drive - an external hard drive, and decided on an off-site backup servce such as Carbonite or Mozy. My computer guru recommended Mozy and every night at 3 a.m., all the files I designated to be saved are backed up to be retrieved if and when needed.

ron
September 20, 2011 1:56 PM

If the hard drive was trashed, there may be another way.

While using Nero Vision to capture a DVD-RW, the app hung. I had to turn off the computer using the power switch. I put the HD in a USB case and found that both the W7 and logical partitions were unidentified file systems. And there were two additional partitions that should not be there.

I tried repairing with W7 install DVD. NG. Used Easy Recover app in a PE disk that has worked in the past. It did not see all files, but those it recovered were damaged. None of the .mpg files would play.

Used TestDisk 6.12. I attached to the PATA in another computer because TestDisk did not see the disk when in USB enclosure.

I opened testdisk_win.exe and chose the advanced mode. It found the hidden W7 boot, the labeled logical partition, and two unlabeled invalid partitions. I used the cursor keys to select the W7 and set it to as the boot partition. I set the logical to logical, and the two invalid partitions set for deletion.

All files were readable and good when viewed XP.

I put drive back in the original computer, and all worked again.

Tom R
September 20, 2011 11:05 PM

I run Windows 7 Ultimate and Kubuntu Natty in a duel-boot configuration. I'm forever messing around with my OSes and occasionally have had to pay the price with an unbootable system. I've lost count of how many times I had to reinstall my operating system(s). No biggie, though, as I always have my personal files backed up to my portable hard drive so other than the time I used for reinstalling/reconfiguring my OSes, nothing was lost. Sometimes I just get bored and trash my OS for fun so I can reinstall. PS: who in the world would ever include the wild card with the rm command? That's a rookie mistake. :-)

Dale
September 21, 2011 8:35 PM

Seagate has excellent recovery software and they have technicians to help. It is not free but the extra bucks are well worth it. Also buy another portable hard drive to write the scanned files to. Memory sticks are slow.
Dale

Glenn P.
September 23, 2011 4:54 AM

Leo wrote:

"I can assure you it wasn't intentional Simply a classing case of wanting to empty a directory thinking I was in that directory when I wasn't."

And that, my dear Leo, is why I set my Unix prompt to display my current working directory. :)

As do I. Which goes to show that there's simply no protection from whomever is at at the keyboard.

23-Sep-2011

•

Comments on this entry are closed.

If you have a question, start by using the search box up at the
top of the page - there's a very good chance that
your question has already been answered on Ask Leo!.